# NIST 800-171 3.6.3 Test the organizational incident response capability.

- Source: https://support.icompaas.com/support/solutions/articles/62000229303-nist-800-171-3-6-3-test-the-organizational-incident-response-capability-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Organizations test incident response capabilities to determine the effectiveness of the capabilities and to identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, simulations (both parallel and full interrupt), and comprehensive exercises. Incident response testing can also include a determination of the effects on organizational operations (e.g., reduction in mission capabilities), organizational assets, and individuals due to incident response.  \[SP 800-84\] provides guidance on testing programs for information technology capabilities. 

  

**Priority**: Medium

  

**Category**: Incident Response Operations 

  

**Services Associated with AWS:**   

-   AWS Security Hub, AWS Incident Manager 

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation of role-based security training being performed
-   Administrative: supporting documentation of professional competence by individual(s) performing incident response roles
-   Administrative: Incident Response Plan (IRP) practices that cover all phases of incident response operations
-   Administrative: supporting documentation of incident response testing / exercises 

  

Possible Technology Considerations : 

NA

  

**What needs to be answered :**  

  

Is there a company incident response policy? Does it outline requirements for regular testing and reviews/improvements to incident response capabilities? Does the company test its incident response capabilities? 

-   Organizational Incident Response Capability Testing  
    Description: This check ensures that organizations regularly test their incident response capabilities to assess their effectiveness and identify potential weaknesses or deficiencies. Incident response testing involves the use of various methods such as checklists, walk-through exercises, simulations, and comprehensive exercises to evaluate the organization's ability to respond to security incidents. 

  

**More Details:**   

Organization response capability tested periodically for all employees and IT staff.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.